In your mobile browser at least Firefox Nightly supports extensions - I have adblock, ghostery, etc. Aside from the privacy benefits it also makes a significant performance difference on my kindle.

https://nightly.mozilla.org/

You can use the stable version too, at least ABP, Ghostery and Self Destructing Cookies works fine on it.

If only it were even just the apps. Check out this blog post by the Tor project and look at what it takes simply securing the OS:

https://blog.torproject.org/blog/mission-impossible-hardenin...

Of particular interest to me was how the captive portal detection reports back to Google everywhere you connect even if everything else is disabled.

I haven't done this personally but you can minimize the risk of interception without really changing anything by going through a VPN. This way all unencrypted traffic is strictly on wired networks.

The VPN secures my data up to the VPN, but it's unencrypted from the VPN to the host.

That might help with the casual Wi-Fi snoop in the coffeeshop, but it's still hoovered up once it leaves the VPN.

Yes, that's true. That's what the situation in the article was, a hostile WiFi access point. I'd say that running a modern platform countermeasures are only useful up to the point that you trust your OS maker and telco. So if you can get your data encrypted until it reaches a major telco's network, then you are almost as safe as if it were all encrypted.

> That's what the situation in the article was, a hostile WiFi access point.

The point of the article was not the hostile AP, but to simulate a pervasive threat:

  we would create a pint-sized version of the Internet
  surveillance infrastructure used by the National
  Security Agency... Porcello would become our one-man
  equivalent of the NSA’s Special Source Operations
  department

Which misses the point of NSA surveillance. Ars knew who they were looking at, and could have multiple people look at that one person's history for whatever they wanted.

The broad surveillance of any practical intelligence apparatus only bothers to do that to target actual subjects of interest, and don't have infinite leeway to not produce results while doing it - i.e. if the NSA produces no useful intelligence on Al Qaeda for a few months, they're looking at budget cuts.

Or to put it another way: how many man hours did they expend on this effort, and how many people do they actually think work for the NSA? It's certainly not "millions".

The NSA does this full-time, with a large staff. They have very elaborate systems designed to automatically pull all this information and organise it into databases for easy lookup.

These guys were manually viewing wireshark dumps. Obviously they're going to spend a lot more time to get the same info when working at such a low level, with no access to any of the automation tools the NSA uses.

You can put on an firewall to block certain apps (requires rooting) but it's true that the measure won't help with "mostly respectable" ones that aren't using https.

On Android, iptables packet filter can be used to control what network connections apps are allowed to make. It is, however, an increased maintenance burden. Recent versions of CyanogenMod also have Privacy Guard pre-installed, which can be used to set granular permissions for apps, such as restricting access to geolocation data.

If you have root then install https://play.google.com/store/apps/details?id=com.googlecode... - at least that way only apps you allow can communicate online.